topic Re: verify an User in Operating System - HP-UX

verify an User

alessandro_37 — Tue, 01 Jun 2004 05:52:01 GMT

dear All,
i have an user on my System HP-UX 11.00 called guest.
I wont know when it is have been created and by who?

grep guest /etc/passwd

guest:*:103:20:Guest login:/home/guest:/sbin/sh

How can I verify and freeze/or blocked this user.
(I wont not cancell the user but only block it)

Thanks Alex

Re: verify an User

Jose Mosquera — Tue, 01 Jun 2004 05:59:14 GMT

Hi,

Check ownership and timestamp of the user home directory by the command:
# ls -l /home/guest

Don't worry about this user. The "*" character in the 2nd field of /etc/passwd file indicates you that this user is locked.

For extra info:
# man passwd

Rgds.

Re: verify an User

Mark Grant — Tue, 01 Jun 2004 06:01:58 GMT

Setting a shell of "/usr/bin/false" is probably the best way of ensuring nobody can log in as the user.

running "last guest" will give you a list of all the times someone has logged in as that user.

Re: verify an User

Chris Wilshaw — Tue, 01 Jun 2004 06:05:53 GMT

The * in /etc/passwd does not always mean that the account is locked. If the system is trusted, this information is held in files under /tcb/files/auth

The simplest way to lock the account is to use

passwd -l guest

(that's a lower case L). This will prevent login, while keeping the ID and all associated files in place.

Re: verify an User

Stanimir — Tue, 01 Jun 2004 06:09:44 GMT

This user is has already been desactivated.
The simpliest way to desactivated the
user is using SAM, menu: Users/Groups.
You can choise the user and make desactivation :).

Re: verify an User

Jose Mosquera — Tue, 01 Jun 2004 06:24:54 GMT

Ooops..!

Alessandro if your system is in trusted mode pls consider the Chris note.

Rgds.

Re: verify an User

Anupam Anshu_1 — Tue, 01 Jun 2004 06:27:26 GMT

To find which user was created when, you will need to switch on auditing (for how to switch on autditing "man 4 audit"). You can switch on auditing through SAM tool too.

Other way of finding out when and how user was created is not known to me. One way could be archiving HISTFILE of the root user :-).

Regards,

Anshu

Re: verify an User

Joseph Loo — Tue, 01 Jun 2004 06:55:33 GMT

hi,

for trusted system, the second segment is * for all accounts in the file /etc/passwd.

for non-trusted system, the second segment is * for account that r disabled.

to check when the last time guest account is use:

# last -R|grep guest|head

regards.